-
Bug
-
Resolution: Done
-
Normal
-
Logging 5.3.0
-
False
-
-
False
-
NEW
-
VERIFIED
-
-
Log Storage - Sprint 227, Log Storage - Sprint 228
-
Moderate
-
QE Confirmed
-
?
Description of problem:
Following error intermittingly when logging in to Kibana:-
{"statusCode":401,"error":"Unauthorized","message":"Authentication Exception"}
It started when the duration of the oauth session has been changed to 10 mins (enforced by a Red Hat compliance operator remediation as per CIS guidelines):
~~~
$ oc get oauth cluster -o yaml
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
annotations:
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
release.openshift.io/create-only: "true"
creationTimestamp: "2022-05-14T11:47:47Z"
generation: 7
name: cluster
ownerReferences:
- apiVersion: config.openshift.io/v1
kind: ClusterVersion
name: version
uid: c7248601-bee7-45c0-956e-e02e2c3eb720
resourceVersion: "44916907"
uid: 753258e4-d31b-453f-a7b8-52a63f018840
spec:
identityProviders:
- ldap:
attributes:
email:
- mail
id:
- desktopProfile
name:
- cn
preferredUsername:
- desktopProfile
bindDN: CN=SRVAPPOCPLDAPDEV01,OU=Application Admins Service Accounts,OU=Application Admins,OU=Shared Services,DC=global,DC=lloydstsb,DC=com
bindPassword:
name: ldap-secret
ca:
name: lbg-ldaps-cert
insecure: false
url: ldaps://dcrlgv0006.global.lloydstsb.com:636/DC=global,DC=lloydstsb,DC=com?desktopProfile
mappingMethod: add
name: global.lloydstsb.com
type: LDAP
tokenConfig:
accessTokenInactivityTimeout: 10m0s
accessTokenMaxAgeSeconds: 32400
~~~
- We can not increase the accessTokenInactivityTimeout to more due to compliance check.
Slack with Logging Engineering: https://coreos.slack.com/archives/CB3HXM2QK/p1660736656526239
Version-Release number of selected component (if applicable):
How reproducible:
The sequence of events is (see attached mp4):
Log onto the OCP UI Select logging - this prompts for another oauth log in After a period of inactivity, kibana reports as being unauthorized If you then log onto the OCP UI and select LOGGING it returns the 401 unauthorized error - if you look at the cookies there is one named _oauth_proxy for the kibana-openshift-logging.apps.<cluster> domain - if you delete this cookie and refresh you a prompted to log in as per step 2.
Actual results: The presence of the _oauth_proxy cookie is causing the problem and we must delete it manually lo log in back.
Expected results:
Not having login issues.
Additional info:
- is cloned by
-
LOG-3306 [release-5.4] Kibana Authentication Exception cookie issue
-
- Closed
-
- links to
- mentioned on